Rowan brings static security scanning to AI applications

Overview

A new open-source tool called Rowan is entering the security landscape with a specific focus on artificial intelligence applications. Developed by hedgerow-dev, the project positions itself as a static analysis scanner designed to find vulnerabilities in both traditional source code and AI/ML project files. Unlike many security tools that require executing code to detect flaws, Rowan operates passively, reading source code and model files to report likely vulnerabilities without running the application.

The tool addresses a growing need in the software development lifecycle, particularly as organizations integrate more complex AI components into their products. By covering areas such as injection attacks, unsafe deserialization, server-side request forgery (SSRF), and leaked secrets, Rowan aims to provide developers with actionable evidence for every finding. The project is currently in an alpha stage, and the developers emphasize that every report should be treated as a lead to investigate rather than a confirmed bug.

How Rowan Works

Rowan distinguishes itself by its ability to analyze a broad spectrum of file types commonly found in AI and machine learning workflows. The scanner inspects model files in formats such as Pickle, PyTorch, GGUF, SafeTensors, Keras, ONNX, TensorFlow, numpy, and joblib. This capability is powered by an integration with Hayward, allowing the tool to identify risks embedded within serialized model data that traditional scanners might overlook.

For source code, the tool provides deep analysis for Python and JavaScript/TypeScript projects, utilizing cross-file dataflow tracking. Support for other languages like Java, Kotlin, C#, Ruby, PHP, and Rust is available but limited to within-file or pattern-based checks. The underlying rule catalog is substantial, comprising 590 rules across 48 YAML files. These are split between 400 regex rules and 190 taint rules, all processed by the Opengrep engine.

The project explicitly states that it never runs user code during the scanning process. This design choice ensures that sensitive environments or fragile models are not disrupted by the security check. The primary goal is to offer a safe, non-invasive method for identifying security holes before they can be exploited in production.

Privacy First: Rowan does not call any large language models (LLMs) or upload code to external servers during a standard scan. The only network activity involves dependency lookups for known CVEs via the OSV service, which can be disabled using the --no-sca flag.

Integration with AI Coding Agents

One of the most notable features of Rowan is its compatibility with popular AI coding agents. The developers have provided specific prompts designed to be pasted directly into tools like Claude Code, Codex, and Cursor. This allows developers to delegate the security scanning process to their AI assistants, streamlining the workflow significantly.

The recommended prompt instructs the agent to install Rowan in an isolated environment, run a self-test to ensure the engine is functioning correctly, and then perform a scan of the current project. The agent is guided to output results in JSON format and to clearly distinguish between findings that have been manually verified and those that remain unconfirmed leads.

This integration reflects a broader trend in software development where AI tools are being used not just to write code, but also to enforce security standards. By allowing agents to interpret and report on security findings, Rowan helps close the gap between rapid AI-assisted development and necessary security oversight. However, the prompt explicitly instructs the agent not to modify any code in the project, ensuring that the scanning process remains read-only and safe.

Installation and Usage

Setting up Rowan requires Python 3.10 or higher and pipx, a tool for installing command-line applications in isolated environments. Users can install the tool via pipx or uv, depending on their preferred package manager. After installation, users are encouraged to run rowan install-engine to set up the underlying scan engine and verify its status with a self-test command.

The core scanning command is straightforward: rowan scan followed by the path to the project directory. The tool offers various flags to customize the output, including options for CI/CD integration, baseline comparisons, and detailed auditing of low-severity findings. For CI pipelines, the tool can be configured to exit with a non-zero status code if high or critical vulnerabilities are detected, enabling automated gates against insecure code.

Reports can be generated in multiple formats, including JSON, HTML, and SARIF, making them compatible with various dashboards and review tools. The developers advise users to review reports carefully before sharing them, as they may contain source code snippets or sensitive information.

Current Status and Limitations

As an alpha release, Rowan comes with significant caveats regarding its completeness and accuracy. The documentation warns that a clean report does not prove a project is secure, and users should expect some findings to be false positives. The tool also indicates when a scan is incomplete, often due to limitations in analyzing certain file types or complex cross-language dependencies.

The project is built on an MIT license, but it relies on the Opengrep engine, which is licensed under LGPL-2.1. This separation means that Opengrep is not bundled with the main distribution, requiring users to install it separately. The development team is actively working on expanding language support and refining the rule set to reduce noise and improve detection accuracy.

For those interested in contributing, the repository provides detailed documentation on architecture and contribution guidelines. A security policy is also in place for reporting vulnerabilities within Rowan itself, ensuring that the tool remains trustworthy as it evolves.